asyncrat | ecfe749ca04339d05d3356c3be6bd1302aec7774422a905ca5312bebf6df7000

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36bcd0bf1863c84be2cdb2398d205887.exe
Size

396KB
MD5

36bcd0bf1863c84be2cdb2398d205887
SHA1

d8165079d9616a3502a4393e27495644196461f0
SHA256

ecfe749ca04339d05d3356c3be6bd1302aec7774422a905ca5312bebf6df7000
SHA512

2fcf561add267895798a08fbc56fa53fd0e34407792f983d1df39448d309296cf75e877f6ffaf316105d883c55eb7015cb4b0c080bc1f288a9cabd17bbf8252e
SSDEEP

6144:n8WER+4xoaTZAvPT+Rd7bFso13zW4yhUp7v0G9BxQZNONJi3Ymz1g:n8Wwr/T2PT+RFqo1jW4csv0wOng

Score

10^/10

asyncrat default rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 11 IoCs

rat

resource	yara_rule
behavioral1/memory/2188-49-0x00000000005C0000-0x00000000006C0000-memory.dmp	asyncrat
behavioral1/memory/2188-60-0x00000000005C0000-0x00000000006C0000-memory.dmp	asyncrat
behavioral1/memory/2592-74-0x0000000000400000-0x0000000000417000-memory.dmp	asyncrat
behavioral1/memory/2592-76-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral1/memory/2592-70-0x0000000000400000-0x0000000000417000-memory.dmp	asyncrat
behavioral1/memory/2592-68-0x0000000000400000-0x0000000000417000-memory.dmp	asyncrat
behavioral1/memory/2188-66-0x00000000005C0000-0x00000000006C0000-memory.dmp	asyncrat
behavioral1/memory/2188-65-0x00000000005C0000-0x00000000006C0000-memory.dmp	asyncrat
behavioral1/memory/2188-64-0x00000000005C0000-0x00000000006C0000-memory.dmp	asyncrat
behavioral1/memory/2188-62-0x00000000005C0000-0x00000000006C0000-memory.dmp	asyncrat
behavioral1/memory/2188-61-0x00000000005C0000-0x00000000006C0000-memory.dmp	asyncrat

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2592	regasm.exe
2592	regasm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 2592	2188	36bcd0bf1863c84be2cdb2398d205887.exe	28

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe
2592	regasm.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2188	36bcd0bf1863c84be2cdb2398d205887.exe
2188	36bcd0bf1863c84be2cdb2398d205887.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2188	36bcd0bf1863c84be2cdb2398d205887.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2640	2188	36bcd0bf1863c84be2cdb2398d205887.exe	29
PID 2188 wrote to memory of 2640	2188	36bcd0bf1863c84be2cdb2398d205887.exe	29
PID 2188 wrote to memory of 2640	2188	36bcd0bf1863c84be2cdb2398d205887.exe	29
PID 2188 wrote to memory of 2640	2188	36bcd0bf1863c84be2cdb2398d205887.exe	29
PID 2188 wrote to memory of 2640	2188	36bcd0bf1863c84be2cdb2398d205887.exe	29
PID 2188 wrote to memory of 2640	2188	36bcd0bf1863c84be2cdb2398d205887.exe	29
PID 2188 wrote to memory of 2640	2188	36bcd0bf1863c84be2cdb2398d205887.exe	29
PID 2188 wrote to memory of 2640	2188	36bcd0bf1863c84be2cdb2398d205887.exe	29
PID 2188 wrote to memory of 2592	2188	36bcd0bf1863c84be2cdb2398d205887.exe	28
PID 2188 wrote to memory of 2592	2188	36bcd0bf1863c84be2cdb2398d205887.exe	28
PID 2188 wrote to memory of 2592	2188	36bcd0bf1863c84be2cdb2398d205887.exe	28
PID 2188 wrote to memory of 2592	2188	36bcd0bf1863c84be2cdb2398d205887.exe	28
PID 2188 wrote to memory of 2592	2188	36bcd0bf1863c84be2cdb2398d205887.exe	28
PID 2188 wrote to memory of 2592	2188	36bcd0bf1863c84be2cdb2398d205887.exe	28
PID 2188 wrote to memory of 2592	2188	36bcd0bf1863c84be2cdb2398d205887.exe	28
PID 2188 wrote to memory of 2592	2188	36bcd0bf1863c84be2cdb2398d205887.exe	28

C:\Users\Admin\AppData\Local\Temp\36bcd0bf1863c84be2cdb2398d205887.exe
"C:\Users\Admin\AppData\Local\Temp\36bcd0bf1863c84be2cdb2398d205887.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
  2⤵
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2188-53-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-7-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-8-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2188-9-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-10-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-11-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-12-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2188-18-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-20-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-22-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2188-23-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-25-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-27-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2188-30-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-32-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-33-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-35-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2188-37-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-38-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-40-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-2-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2188-45-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2188-49-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-52-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-51-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2188-50-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-48-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-47-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-43-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-16-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-60-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-71-0x0000000072940000-0x0000000072A93000-memory.dmp

Filesize
1.3MB

Download
memory/2188-61-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-73-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2188-62-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-63-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2188-64-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-67-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/2188-66-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2188-65-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2592-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2592-70-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2592-76-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2592-74-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download